SpeakUp Linux Backdoor targets Linux servers in East Asia and LATAM.

JBoss Seam 2 (jboss-seam2), as used in Red Hat JBoss Enterprise Application Platform (EAP) 4.3.0 for Red Hat Linux, is vulnerable to remote code execution caused by an input validation flaw (CWE-20) in its processing of Expression Language (EL) expressions. A remote attacker triggers the flaw by sending crafted input containing EL expressions that the Seam framework evaluates without sufficient validation; exploitation succeeds only when the Java Security Manager is not properly configured, which is the typical default. Successful exploitation lets the attacker run arbitrary code with the privileges of the JBoss server process, providing a foothold on the host and access to any back-end systems the application server can reach. Organizations still running legacy Red Hat JBoss EAP 4.3.0 / Seam 2 deployments, particularly internet-facing ones, are in scope, and the flaw is in the CISA Known Exploited Vulnerabilities (KEV) catalog, obliging U.S. federal agencies to apply vendor updates. It was added to KEV on 2021-12-10, confirming in-the-wild exploitation (ransomware use unknown); it carries a very high EPSS of 83.4% (100th percentile) and no public proof-of-concept is known.

Do: Apply Red Hat's patched jboss-seam2 update for JBoss Enterprise Application Platform 4.3.0 per vendor instructions (RHSA-2010:0574); where immediate patching is not possible, properly configure the Java Security Manager for the JBoss JVM — the flaw is only exploitable when it is not properly configured — and restrict untrusted EL input and internet exposure of Seam-based applications. Inventory legacy JBoss EAP 4.x/Seam 2 hosts, prioritize internet-facing Linux servers given active Linux-targeting threats such as the SpeakUp backdoor, and check those hosts for signs of compromise. Remediation is required for U.S. federal agencies under CISA's KEV requirement (listed 2021-12-10).

CVE-2016-3088 is an improper input-validation flaw (CWE-434) in the Fileserver web application bundled with Apache ActiveMQ 5.x, which lets anyone upload files to the broker without authenticating. An attacker triggers it by sending an HTTP PUT request that uploads an attacker-controlled file (typically a crafted JSP) and then an HTTP MOVE request that relocates that file into a directory served by the embedded web console, where the Jetty web container executes it. This yields unauthenticated remote code execution with the privileges of the ActiveMQ process (CVSS 3.1: 9.8 critical, network-vector, no privileges or user interaction required). Any deployment of ActiveMQ 5.x prior to 5.14.0 is affected, and internet-exposed brokers are the most directly at risk. The flaw is actively exploited: it is in CISA's Known Exploited Vulnerabilities catalog (added 2022-02-10), has a public PoC on Exploit-DB, a 98.5% EPSS score, and has been used by real-world malware such as the XBash ransomware/miner and the Pro-Ocean crypto-mining campaign.

Do: Upgrade to Apache ActiveMQ 5.14.0 or later, ideally a current supported release per vendor instructions. If upgrading is not immediately possible, disable or remove the Fileserver web application or restrict network access to the embedded Jetty web console (default TCP 8161) so it is not internet-exposed. Check web-access logs for suspicious HTTP PUT/MOVE requests against /fileserver/ and for unexpected JSP or script files in the web console directories, which would indicate prior compromise.

Oracle WebLogic Server (CVE-2017-10271) contains a remote code execution flaw in its WLS Security component, where an XMLDecoder deserialization bug allows unauthenticated attackers to execute arbitrary code. The flaw is triggered by sending specially crafted XML requests to exposed WebLogic HTTP endpoints, so any instance whose WebLogic ports are reachable by untrusted users is at risk. Successful exploitation yields arbitrary code execution on the application server host, and the bug has been widely leveraged to install cryptominers and ransomware payloads. Organizations running Oracle WebLogic Server — particularly instances directly exposed to the internet — are affected, and the flaw has been on CISA's Known Exploited Vulnerabilities catalog since 2022-02-10 with confirmed ransomware use. Exploitation is assessed as essentially certain in the near term (EPSS 100.0%, 100th percentile), and defenders should treat it as an actively exploited, high-priority issue.

Do: Apply Oracle's updates for CVE-2017-10271 per Oracle's instructions (the vendor's required action for this KEV entry). Until patched, restrict network access to WebLogic HTTP/admin ports from untrusted networks and limit or remove access to the XML/WSAT endpoints used for exploitation. Because ransomware operators are known to exploit this flaw, review internet-exposed WebLogic instances for signs of compromise, such as unexpected processes, new scheduled tasks, webshells, or ransomware artifacts.

NoneCms V1.3, an open-source Chinese CMS built on the ThinkPHP 5.0.x framework, is vulnerable to unauthenticated remote code execution through the framework's URL dispatcher in thinkphp/library/think/App.php. Because the framework's 's' routing parameter can invoke arbitrary framework classes and methods, an attacker can pass a crafted 'filter' value (e.g., s=index/\think\Request/input&filter=phpinfo&data=1) that is applied to the 'data' argument as a callable, executing attacker-chosen PHP functions or code. Successful exploitation gives full code execution on the web server under the application's privileges, enabling web shells, botnet implants, and ransomware staging without any credentials or user interaction. Any internet-facing deployment of noneCms V1.3 — and, more broadly, applications running the affected ThinkPHP 5.0.x framework (the public PoC references 5.0.23) — is exposed. Exploitation is confirmed in the wild: the flaw is on CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), EPSS assigns a 99.5% probability of exploitation within 30 days, and headlines note botnets such as Enemybot and Chinese threat actors chaining ThinkPHP RCEs against CMS servers.

Do: Apply updates per vendor instructions: upgrade noneCms to the latest release and update the bundled ThinkPHP 5.0.x framework to a patched build. Inspect web server and WAF logs for requests using the s=index/\think\Request/input&filter=... pattern and other ThinkPHP route-invocation payloads, and hunt for web shells or post-exploitation artifacts. Until patched, block or strictly validate the 's' and 'filter' query parameters at a WAF/reverse proxy and limit internet exposure of the application.

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).